CVE-2019-10964
Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
Medtronic MiniMed Insulin Pumps
are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
Medtronic MiniMed Insulin Pumps
are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- Record
CVE-2019-10964- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2019-2678
Medtronic MiniMed Insulin Pumps
are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- Record
EUVD-2019-2678- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-54f2-q9g6-3cvc
In Medtronic MinMed 508 and Medtronic Minimed Paradigm Insulin Pumps, Versions, MiniMed 508 pump ...
In Medtronic MinMed 508 and Medtronic Minimed Paradigm Insulin Pumps, Versions, MiniMed 508 pump ? All versions, MiniMed Paradigm 511 pump ? All versions, MiniMed Paradigm 512/712 pumps ? All versions, MiniMed Paradigm 712E pump?All versions, MiniMed Paradigm 515/715 pumps?All versions, MiniMed Paradigm 522/722 pumps ? All versions,MiniMed Paradigm 522K/722K pumps ? All versions, MiniMed Paradigm 523/723 pumps ? Software versions 2.4A or lower, MiniMed Paradigm 523K/723K pumps ? Software, versions 2.4A or lower, MiniMed Paradigm Veo 554/754 pumps ? Software versions 2.6A or lower, MiniMed Paradigm Veo 554CM and 754CM models only ? Software versions 2.7A or lower, the affected insulin pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- Record
GHSA-54f2-q9g6-3cvc- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-284, CWE-287
- Updated
- 2026-11-02
NVD
Medtronic MiniMed Insulin Pumps
are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- Record
CVE-2019-10964- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:A/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-284, CWE-287, CWE-863
- Updated
- 2026-11-02
Affected products
- medtronic minimed 508 pump
- medtronic minimed paradigm 511 pump
- medtronic minimed paradigm 512/712 pumps
- medtronic minimed paradigm 515/715 pumps
- medtronic minimed paradigm 522/722 pumps
- medtronic minimed paradigm 522k/722k pumps
- medtronic minimed paradigm 523/723 pumps
- medtronic minimed paradigm 523k/723k pumps
- medtronic minimed paradigm 712e pump
- medtronic minimed paradigm veo 554/754 pumps
- medtronic minimed paradigm veo 554cm/754cm pumps
- medtronic minimed 508 firmware
Show 18 moreShow less
- medtronic minimed paradigm 511 firmware
- medtronic minimed paradigm 512 firmware
- medtronic minimed paradigm 515 firmware
- medtronic minimed paradigm 522 firmware
- medtronic minimed paradigm 522k firmware
- medtronic minimed paradigm 523 firmware
- medtronic minimed paradigm 523k firmware
- medtronic minimed paradigm 712 firmware
- medtronic minimed paradigm 712e firmware
- medtronic minimed paradigm 715 firmware
- medtronic minimed paradigm 722 firmware
- medtronic minimed paradigm 722k firmware
- medtronic minimed paradigm 723 firmware
- medtronic minimed paradigm 723k firmware
- medtronic minimed paradigm veo 554 firmware
- medtronic minimed paradigm veo 554cm firmware
- medtronic minimed paradigm veo 754 firmware
- medtronic minimed paradigm veo 754cm firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10964 is a high vulnerability (CVSS 7.1) in Medtronic Minimed 508 Pump, published June 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. No source names a fixed version.